Cleo AI: Cash Advance & Money

"We may share information about you with suppliers that we engage to help us provide certain services and/or functionality e.g. online payment processing and credit bureaus. We will use reasonable endeavours to control and be responsible for the use of your information by such suppliers."

Cleo shares personal, financial, and KYC data with a very long list of third parties including Plaid, Stripe, Google, OpenAI, Equifax, TransUnion, Experian, Socure, Rakuten Advertising, BitBurst, and many others — extending well beyond what users might expect from a budgeting app.

"Rakuten Advertising may collect personal information when you interact with our digital property, including IP addresses, digital identifiers, information about your web browsing and app usage and how you interact with our properties and ads for a variety of purposes, such as personalization of offers or advertisements."

Rakuten Advertising and BitBurst both collect advertising IDs, device IDs, digital identifiers, and browsing behavior to personalize ads and track users across properties, enabling cross-service tracking and profiling.

"When a user connects to this app, certain device and connection data (including Advertising ID, Device ID, and whether and how the user enabled access to the same) is automatically sent, via our app, to BitBurst servers to enable Rewarded Activities to display through our app."

The BitBurst SDK automatically transmits device identifiers including Advertising ID and Device ID to external servers upon app connection, which goes beyond what is needed for a financial management app's core functionality.

"We collect the following personal information from you automatically when you visit our websites or use our online services: The Internet Protocol (IP) address used to connect your computer or access device to the internet... Your geographic location."

Cleo automatically collects users' geographic location and IP address when they use the service, without clearly explaining how precise this location data is or how long it is retained.

"As things are always changing, we reserve the right to revise or add to this Privacy Policy on occasion. We encourage you to bookmark and review this page periodically to ensure you are familiar with the most current version of this Policy and that you are aware of what information we collect, how we use it, and under what circumstances we disclose it."

Cleo reserves the right to change the privacy policy at any time, placing the burden on users to periodically check for updates. While they mention email alerts for 'major' changes, that qualifier is subjective and at their discretion.

"If you cancel your user account for the Service, we will promptly and securely delete all of the Personal Information we hold about you. However, we reserve the right to retain any Anonymous Data collected up to the point of cancellation and to continue using it in accordance with this policy."

While Cleo commits to deleting personal data, they retain all anonymized data indefinitely after account cancellation with no timeline or limits, and the boundary between 'personal' and 'anonymous' data is not clearly defined.